Mental Model

AgentAgentA worker you delegate to: brief it, and it takes steps on its own. A chatbot answers; an agent acts.An LLM that runs tools in a loop toward a goal — it acts, checks the result, decides the next step, and repeats until done.Full definitionClose settings govern four separate layers:

1. Capability — which tools, skills, agents, servers, and models exist.
2. Authorization — which actions are allowed, denied, or require approval.
3. Isolation — what the executing process can actually access.
4. Policy — which higher-trust controls a user or repository cannot weaken.

Project instructions sit beside these layers as behavioral guidance. They should explain the operating model but cannot substitute for it.

Effective Configuration

The setting written in one file is not necessarily the setting in force. Products merge user, repository, local, environment, command-line, IDE, cloud, and managed sources differently. Correctness depends on the resolved configuration at execution time.

Defense in Depth

A tool deny rule constrains the tool router. A sandbox constrains the process. An MCPMCPUSB-C for AI — one standard plug so any agent can connect to any data source or tool.The Model Context Protocol: an open standard (Anthropic, 2024) for connecting AI systems to external tools and data without building a custom integration for each one.Full definitionClose credential constrains the external service. CI constrains release. Each covers paths the others may not see.

The crux is the bypass graph: enumerate every route to the protected outcome, then place controls at the narrowest independently governed boundaries.